Description
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ulicms | Ulicms | 2023.1 | — |
References
- ExploitDB-51486 exploit
- Archived Product Webpage product
- VulnCheck Advisory: UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability third-party-advisory